Jim Schwar

Security specialist who hunts for evil. Incident Responder, amateur malware analyst, independent security researcher.

[Jim Schwar @jimiDFIR]

One of the greatest joys in my life is watching someone I know succeed.

[Matt Zorich @reprise_99]

I know some people often wonder if an Application Id they see in logs is a first-party Microsoft app, I wrote this KQL to pull down the list of apps from the MS Learn doc itself and create a table from it, so you can then query it and join to it etc - https://t.co/x9MfCefuHF

[Jim Schwar @jimiDFIR]

@njtreker @mbw1024 no you didn’t. Sam’s club has too long of a line to wait in for just foil. You knew what you were doing and succeeded brilliantly

[Jim Schwar @jimiDFIR]

@SecurePeacock An analytics platform that has a robust query language and properly parsed data.

[Jim Schwar @jimiDFIR]

regex is like Jenga, one wrong move and the whole effing thing comes crashing down

[Jim Schwar @jimiDFIR]

Regex: when you want to match some characters, but not too many characters, but also maybe some other characters, but not those characters, unless they're followed by these other characters... you know what, never mind, let's just use brute force. 🤯🤯🤯

[Jim Schwar @jimiDFIR]

It drives me bonkers that not all SIEMs support this and why I really like analytics platforms as the basis for threat detection/response.

[Jim Schwar @jimiDFIR]

Log parsing is the process of analyzing and extracting relevant information from log data. It is a critical component of security monitoring and threat detection.

[Jim Schwar @jimiDFIR]

The choice of parsing method depends on the specific use case, the types of data being analyzed. You need all of the above available to engineers to quickly and effectively get data in front of your analysts

[Jim Schwar @jimiDFIR]

SIEM technology is like that one annoying co-worker who always has something to say but never really delivers.

[Jim Schwar @jimiDFIR]

🧵

[Dan Sherry @netbroom]

As someone who has built import/export for STIX/TAXII from scratch, i think it can be improved in a few ways.

[Matt Zorich @reprise_99]

The billions of dollars of investment into ChatGPT and OpenAI will be worth every cent even if all I ever use it for is to solve my regex problems.

[JS0N Haddix @Jhaddix]

🔍 My ultimate workflow for simple and easy JavaScript Analysis

⚡️ Comprehensive JavaScript analysis in offensive security, appsec testing, and red teaming wins.

Often you can find juicy hidden endpoints, parameters, & domains buried JS!

A thread 🧵 1/x
👇

[EvilMog® @mog.evil.af @Evil_Mog]

If you know what the turbo button is for don't forget to take an anti-inflammatory for your back and knees today

[Jim Schwar @jimiDFIR]

@topicm Why? Fear is a tremendous motivator and tool if used properly.